Extracted

• • Target

    2ZR0z3TXvgQYz22.exe

  • Size

    585KB

  • MD5

    93d572f4af087a6ecd3dd36c3fc9a4b2

  • SHA1

    d985438163ca837a7e3ea211749427087230eff3

  • SHA256

    f42ff1b3995ca789686b11f28cd181c4a17f5afce76bcb6b6ee4c97339f5ec75

  • SHA512

    7697ff4c1c85997ab076bae1b98047b0c24ad0f43c12a7ed7f4be595cef2a9859abc26358244d63609eafabd9444178c90564d01adfde899b21d35f25649995f

  • SSDEEP

    12288:BwtkzrbETClzHskFgFwIyXCDj1nINpuJWb1//vZ6GJI7lJVFuksyoWeP:h76CBskFgqIyXI1nspuJWv6GJI7lrFXW

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2